CVE-2025-39785: 
Linux Debian vulnerability analysis and mitigation

A vulnerability was discovered in the Linux kernel related to the drm/hisilicon/hibmc driver's irqrequest() function. The issue was disclosed on September 11, 2025, and involves a use-after-free problem caused by passing a local variable to requestirq(). This vulnerability affects various Linux distributions including Debian, Ubuntu, and Red Hat systems (NVD CVE, Debian Tracker).

The vulnerability stems from a local variable being passed to the requestirq() function in the drm/hisilicon/hibmc driver, which results in a use-after-free condition. This implementation flaw causes the requestirq operation to fail. The issue has been identified in multiple Linux kernel versions, including those used in Debian distributions from bullseye through trixie (Debian Tracker).

The vulnerability can cause the request_irq operation to fail, potentially affecting system stability and driver functionality in systems using the Hisilicon hibmc graphics driver (NVD CVE).

The vulnerability has been fixed by using a global IRQ name instead of a local variable. Various Linux distributions have released patches, including Debian which has fixed versions available across multiple releases: bullseye (5.10.237-1), bookworm (6.1.147-1), trixie (6.12.41-1), and forky/sid (6.16.7-1) (Debian Tracker).